Course and certificate
UK GDPR and Data Protection Awareness
For anyone in the UK who handles personal data at work: office and admin staff, retail and hospitality teams, care and health workers, school and nursery staff. Eight short lessons in plain English explain the UK GDPR and the Data Protection Act 2018, including changes from the Data (Use and Access) Act 2025, personal and special category data, the seven principles, lawful bases, people's rights and subject access requests, everyday security, personal data breaches, marketing rules and the ICO's powers, followed by a 25-question test.
- Jurisdiction
- 🇬🇧 United Kingdom
- Languages
- English, Български, Español, Italiano, Polski, Português, Română, Українська
- Lessons
- 8
- Time needed
- About 45 minutes for the lessons and the test
- Assessment
- 25 questions, pass mark 80%
- Refresher
- Recommended after 2 years
- Content updated
- 27 October 2026
- Certificate fee
- £12.00, payable after passing
01Who this course is for
- Office, admin and reception staff
- Retail, hospitality and customer service teams
- Care, health and nursery workers
- School and college support staff
- HR, finance and marketing staff
- Anyone starting a job in the UK where customer, patient or staff data is used
02Syllabus
03Assessment
25 multiple-choice questions drawn from the whole course. The pass mark is 80%. The test is free and can be retaken as often as needed; wrong answers point to the lesson to read again.
04The certificate
- With your name, your score and the date you passed.
- A unique number, recorded in our register.
- Your employer or an inspector scans it to see that it is genuine.
- Download it, print it or show it on your phone.
05Sources
The course follows the published guidance below. We are not affiliated with the bodies that publish it.
- ICO — Personal data breaches
- UK GDPR Article 32
- Data (Use and Access) Act 2025
- UK GDPR Article 33
- UK GDPR Article 5
- ICO — Data sharing code
06Questions
Is data protection training a legal requirement?
The UK GDPR requires organisations to have appropriate measures in place, and the ICO expects staff who handle personal data to be trained for their role. The law does not name a particular course or certificate.
Is this certificate accredited?
No. It is a certificate of completion: it shows you finished this general UK GDPR awareness course and passed its test. It is not a regulated or accredited qualification, and your employer decides whether this training meets their needs.
Does this course replace the training my employer must give me?
No. It teaches the general rules that apply in any UK workplace. Your employer must still give you its own data protection policies, its breach and subject access procedures, and training for your role, for example in HR, marketing, health or care. Some organisations must also have a data protection officer and keep records of their processing.
Does the course cover the Data (Use and Access) Act 2025?
Yes, in outline. It explains the main changes that matter to staff, such as subject access requests, complaints and higher PECR fines. Rules are still being clarified by the ICO, so check ico.org.uk for the latest guidance.
How long does it take?
Most people finish the lessons and the 25-question test in about an hour. You can stop and come back at any time on the same device.
What if I fail the test?
Nothing is charged. You see which lessons to read again and can retake the test as often as you need.
When do I pay, and how much?
Only after you pass: £12 for the certificate. The course and the test are free.
How does my employer check the certificate?
Every certificate has a number and a QR code. Scanning it, or entering the number on our check page, shows your name, the course and the date you passed.
How long is the certificate valid?
No law sets an expiry date for this kind of awareness training. Refresher training about every one to two years is common practice, so the certificate shows a renewal date 24 months after you pass. Check what your employer requires.
The certificate confirms that you completed this course and passed its test. It is not a regulated or accredited qualification; your employer decides whether this training meets their requirements.